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IN THE CLAIMS: 
1 -36. (cancelled). 

37 . (new) An access method, comprising: 

receiving at a storage engine a certificate from the host device, the certificate 
containing a digital signature; 

authenticating the digital signature; 

receiving at the storage engine a file request from the authenticated host device, 
the file request being directed to a file stored on a storage medium accessible to the 
storage engine; 

within the storage engine, reading security metadata associated with the file from 
the storage medium, the security metadata containing at least one rule governing access 
to the file; 

. within the storage engine, applying the at least one rule to the file request from the 
host device; and 

if the application of the at least one rule provides a failing result, denying the file 
request. 

38, (new) The method of claim 37, wherein the at least one rule comprises a plurality of 
rules. 

39. (new) The method of claim 37, wherein the storage medium is an optical disk. 
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40. (new) The method of claim 37, wherein the application of the at least one rule act 
comprises checking play privileges for the host device, 

41 . (new) The method of claim 37, further comprising: if the application of the at least 
one rule provides a successful result, granting the file request. 

42. (new) A storage engine, comprising: 

authentication means for authenticating a digital signature contained in a 
certificate from a host device, and 

file request response means for responding to file requests fiom the host device, 
each file request identifying a particular file, the file request response means being 
responsive to file requests only if the authentication means authenticates the digital 
signature, the file request response means being configured to read security metadata 
associated with the file from a storage medium, the security metadata containing at least 
one rule governing access to the file; the file request response means being configured to 
apply the at least one rule to the file request from the host device; the file request 
response means being configured to deny the file request if the application of the at least 
one rule provides a failing result. 

43. (new) The storage engine of claim 42, wherein the storage medium is an optical disk. 
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